Hacker News Reader

Comment by tptacek | Hacker News Reader

Then you were wrong, since those attacks against unpatched, unhardened hosts are trivially weaponizable through browser Javascript.

View on HN

They're weaponizable when using a small and rapidly shrinking percentage of unpatched browsers running JavaScript delivered by extremely uncommon websites.

That's true because the vulnerability itself wasn't overblown, and was immediately patched.

I am particularly talking about things like Intel's stock price though

Oh. Sure, I buy that. I don't believe patchable vulnerabilities really exert major pressure on stock prices.

>JavaScript delivered by extremely uncommon websites

All it takes it emailing them a slightly convincing link, and they're running javascript from one of those "extremely uncommon websites". It doesn't matter how common the website it, a single website can compromise millions of users.

Attacks only get better.

Can you point to a javascript example?

I can think of a number of approaches, but nothing I could catergorise as trivial.

First hit for googling "Spectre Javascript POC": https://github.com/ascendr/spectre-chrome

> Enable `#shared-array-buffer` in `chrome:///flags` under your own risk...

SharedArrayBuffer was disabled exactly because vulnerabilities like this are easily exploitable (but there are POCs that don't depend on it).

It was only disabled as a mitigation to these specific attacks, in case you though it was an experimental or “at your own risk” type of thing.

Disabling SharedArrayBuffer is just stopping the most obvious method of exploitation; it's by no means a fix. Expect a slew of papers over the next few years on other methods of exploitation from JS.

Every single browser had to disable that feature because of those flaws.

Reply on news.ycombinator.com